PyPI Under Attack: New Malware ‘SilentSync’ Is Stealing Credentials

Zscaler ThreatLabz has uncovered a new supply chain attack targeting the Python Package Index (PyPI), with two malicious packages named sisaws and secmeasure masquerading as legitimate libraries in August 2025 and delivering a Python-based RAT dubbed SilentSync. ThreatLabz noted that in July 2025 a malicious package named termncolor was identified, and a few weeks later, on August 4, 2025, two more malicious packages were found, all authored by the same actor.

The sisaws package impersonated Argentina’s official healthcare integration modules, while secmeasure pretended to be a simple string-cleaning library; both contained hidden functions that downloaded and executed SilentSync from Pastebin. According to Zscaler’s analysis, SilentSync is capable of remote command execution, file exfiltration and screen capturing, and it extracts data such as credentials, history, autofill data and cookies from web browsers including Chrome, Brave, Edge and Firefox.

The malware establishes persistence across Windows, Linux and macOS, using registry entries, crontab @reboot directives and LaunchAgents, respectively, and communicates with its C2 server over HTTP with periodic beaconing and task polling.